supply-chain-attack-recon

To check for supply chain vulnerabilities in GitHub Actions workflows, this skill inspects CI/CD configurations for security issues and analyzes package dependencies. It performs reconnaissance on public GitHub organizations to identify configuration flaws and exposed secrets.

Dependency confusion is a supply chain attack where malicious packages replace internal ones. This skill detects it during package analysis by checking for unclaimed package names, dependency confusion, and typosquatting across your software project's dependencies.

Yes, you can scan Docker images and SBOMs for exposed secrets. This skill performs artifact analysis to inspect external artifacts, identifying vulnerabilities and exposed sensitive data within your software supply chain components.

Yes, supply chain security analysis requires various tools for dependency analysis, CI/CD scanning, and artifact inspection. The skill applies to public GitHub orgs and CI/CD pipelines, needing these external tools to perform comprehensive reconnaissance.

The best way to assess the security posture of a software project with a public GitHub org is running comprehensive reconnaissance. This skill analyzes package dependencies, CI/CD configurations, and external artifacts to identify potential software supply-chain vulnerabilities.